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Remarks 

Claims 1-7, 9, 12-18, and 42-46 are currently pending in the subject application and are 
presently under consideration. Claims 1 and 13 have been amended herein, claims 42-46 have 
been added, and claims 8, 10, 11, and 19-41 have been cancelled. A listing of all claims can be 
found at pages 2-5. 

Favorable reconsideration of the subject patent application is respectfully requested in 
view of the comments and amendments herein. 

I. Rejection of Claims 1-7, 9, and 12-18 Under 35 U.S.C. §103(a) 

Claims 1-7, 9, and 12-18 stand rejected under 35 U.S.C. § 103(a) as being unpatentable 
over Glass et al. (U.S. Appln. No. 2005/0060643) in view of Kephart (U.S. 6,732,149). This 
rejection should be withdrawn for at least the following reasons. Neither Glass et al. nor Kephart 
disclose each element as set forth in the subject claims. 

The subject application relates to identifying both legitimate and undesirable mail. (See 
Abstract.) Specifically, the subject application relates to extracting message features particular 
to spam to facilitate spam prevention. (See id.) Independent claim 1 , from which claims 2-7, 9 
and 12-18 depend recites, in part, a system that facilitates extracting data in connection with 
spam processing, comprising ...an analysis component that examines consecutiveness of 
characters within a subject line of a message and a content type of the message for spam in 
connection with building a filter, wherein the content type is case-sensitive, comprises primary 
content-type and a secondary-content type, or combinations thereof Examination of the 
content type identified in the message can help detect and identify spam since spammers attempt 
to mimic qualities of non-spam messages. (See e.g., pg. 9, Ins. 1 1-12 and pg. 18, Ins. 1-2.) The 
content type can be case-sensitive to more accurately capture variations in content-type notations 
provided by message sending applications. (See e.g., pg. 3, Ins. 23-25.) Further, content-type 
can be case-sensitive to more accurately capture variations of primary and/or secondary MIME 
content-types. (See e.g., pg. 9, Ins. 12-14.) Additionally, primary content-type and secondary- 
content type can help identify messages that are forged or misrepresented to make the message 
appear to be non-spam. (See e.g., pg. 3, Ins. 16-19 and pg. 14, Ins. 5-7.) The cited art does not 
disclose, teach, or suggest at least these elements. 



6 



10/790,574 



MS307141.01/MSFTP573US 



Glass et al. relates to document similarity detection and a classification system. Glass et 
al. compares documents to determine a highest level of resemblance between an unclassified 
document and a set of previously classified documents. (See Abstract.) Glass et al. is concerned 
with preclassifying documents to aid in comparing the documents. This is simply placing the 
documents in a similar format for comparison; it is not examining a content type of the message 
for spam, as claimed. Further, as conceded in the Final Office Action, Glass et al. does not teach 
or suggest that the analysis component examines the consecutiveness of characters within a 
subject line of the message and Kephart is incorrectly relied upon to overcome the deficiencies 
of Glass et al. 

Kephart relates to hindering an undesirable transmission or receipt of electronic 
messages. Specifically Kephart discusses a method for computing HashBlock data for a given 
message. (See col. 13, In. 65 to col. 14, Ins. 25.) The HashBlock is defined as a block of data 
computed from the body of the archetype and is used to measure overall similarity to other 
messages. (See col. 10 In. 67 to col. 1 1, In. 3.) The method includes transforming the message 
body, dividing the transformed message body into small individual units that might overlap, and 
for each individual unit, a hash function maps that unit to a small integer hash value. (See col. 
13, In. 65 to col. 14, Ins. 25.) An array of these hash value counts is kept and is incremented by 
one each time a particular hash value is computed. (See id.). While describing the method, 
Kephart provides an example individual unit as being "all consecutive 5-character sequences". 
However, Kephart does not teach or suggest examining consecutiveness of characters within a 
subject line of the message, as claimed. Kephart merely utilizes the term "consecutive" in an 
example while discussing a method for deriving HashBlock Data from a message body. Further, 
Kephart is silent regarding examining a content type of the message for spam, as recited in 
independent claim 1 . 

Additionally claim 2, which depends from claim 1, recite the analysis component 
determines frequency of consecutive repeating characters within the subject line of the 
message. In an example, a message having a small number of consecutive, repeating characters 
in the subject line might be a legitimate message while a message having a higher number of 
consecutive, repeating characters in its subject line might be a spam message. (See e.g., pg. 8, 
Ins. 8-10.) Glass et al. is silent regarding at least these elements of claim 2. Further, as 
discussed above, Kephart relates to deriving HashBlock data by transforming a message body 
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before signature extraction. (See e.g., col. 13, In. 65 to col. 14, Ins. 7). The message body is 
divided into small individual units which can overlap (e.g., consecutive 5 -character sequences) 
or not overlap (e.g., individual units delimited by black spaces, which is preferred. (See e.g., col. 
14, Ins. 9-13.) A hash function maps each unit to a small integer hash value and an array of 256 
hash values is expressed as a HashBlock. (See e.g., col. 14, Ins. 13-25.) This is merely deriving 
HashBlock data from the body of a message and the 5-character sequences (as described above) 
are simply consecutive sequences, not consecutive, repeating characters, as claimed. Since there 
is no teaching or suggestion in the cited art with respect to an analysis component that 
determines frequency of consecutive repeating characters within the subject line of the message, 
it would not have been obvious to a person having ordinary skill in the art to modify the cited art 
as proposed. 

Further, claim 5, which depends from claim 1, recites the analysis component 
determines distance between at least one alpha-numeric character and a blob. As described in 
the detailed description, a blob is a random sequence of characters, numbers, and/or punctuation. 
(Se e.g., pg. 2, In. 31.) In some instances, the blob can be hidden from the message recipient's 
view. (See e.g., pg. 3, In. 3-6.) Thus, the distance between at least one alpha-numeric character 
and a blob can be determined by analysis component in connection with spam processing. Both 
Glass et al. and Kephart are silent regarding a blob and, further, both are silent regarding an 
analysis component that determines distance between at least one alpha-numeric character and a 
blob, as claimed. 

Further, with respect to newly added claims 42-46, independent claim 42 recites in part, a 
method for evaluating spam as a function of message content, comprising . . . examining the 
extracted set of features and consecutiveness of repeating characters within a subject line of 
the message to classify the message as spam or not spam . . . Neither Glass et al. nor Kephart 
teach or suggest at least these elements. Glass et al. relates to placing documents in a similar 
format for comparison and Kephart relates to deriving HashBlock data from a body of a 
message. 

Based on at least the above, it is apparent that neither Glass et al. nor Kephart teach or 
suggest all elements of claims 1 (and the claims that depend there from), 2 and 5. It is 
respectfully requested that this rejection be withdrawn and the subject claims allowed. 
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Conclusion 

The present application is believed to be in condition for allowance in view of the above 
comments and amendments. A prompt action to such end is earnestly solicited. 

In the event any fees are due in connection with this document, the Commissioner is 
authorized to charge those fees to Deposit Account No. 50-1063 [MSFTP573US]. 

Should the Examiner believe a telephone interview would be helpful to expedite 
favorable prosecution, the Examiner is invited to contact applicants' undersigned representative 
at the telephone number below. 



Respectfully submitted, 
Amin, Turocy & Calvin, llp 



/Patrica S. Murphy/ 
Patrica S. Murphy 
Reg. No. 55,964 



Amin, Turocy & Calvin, llp 
57 th Floor, Key Tower 
127 Public Square 
Cleveland, Ohio 44114 
Telephone (216) 696-8730 
Facsimile (216) 696-8731 
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